THREAT actors seized control of the Axios maintainer’s npm account (according to Aikido.dev) and released two tainted versions of the widely used HTTP client, inserting a malicious dependency that deployed remote access trojans across developer workstations. The compromised releases, labelled 1.14.1 and 0.30.4, appeared in the registry shortly after the account takeover and quickly reached projects that rely on Axios for browser and server‑side requests. With the library logging more than a hundred million weekly downloads, the supply chain move threatened a broad base of JavaScript applications.
Investigators said the attackers obtained Jason Saayman’s credentials through undisclosed means, changed the account email to lock out the legitimate maintainer and also took over his GitHub profile to mask their activity. They then published the fraudant Axios builds within an hour, noting that the releases lacked OpenID Connect verification and did not match any commits in the official repository (per SecurityAffairs). The malicious versions introduced a package called plain‑crypto‑js as a direct dependency, a move that bypassed typical checksum checks because the name appeared innocuous.
Once installed, the plain‑crypto‑js package ran a post‑install script that probed the host operating system, selected a matching binary from a remote server and executed it, giving the attacker a persistent reverse shell. The script used simple obfuscation to hide its calls and checked for Linux, Windows or macOS before pulling down the appropriate payload (Trend Micro analysis). Because the payload arrived through a trusted npm install step, many security tools that only scan for known malware signatures failed to flag the activity.
The intrusion was observed between 31 March and 1 April 2026, with no official attribution from law enforcement or vendor advisories, although a TechCrunch report linked the activity to North Korean state‑sponsored actors seeking to expand their toolkit. Security researchers warned that the event highlights how a single compromised maintainer account can jeopardise millions of downstream projects, especially when a library enjoys the installation volume that Axios commands. The incident adds to a growing list of supply chain abuses that exploit trust in open source registries (TechCrunch).
Defenders should immediately audit any project that locks Axios to the exact versions 1.14.1 or 0.30.4 and replace them with a clean release from the official line, preferably using a lockfile that records exact checksums. Enabling mandatory multi‑factor authentication on npm and GitHub accounts for maintainers reduces the chance of credential theft, while configuring branch protection rules stops unauthorized pushes (Infosecurity Magazine). Running npm audit with integrity verification turned on can catch future inserts of unexpected dependencies before they reach production.
Organisations are also encouraged to review post‑install scripts in all dependencies, treat any script that downloads external binaries as high risk and block execution unless explicitly approved. Maintaining an up‑to‑date software bill of materials helps trace which components entered the build pipeline, and rotating API keys and service tokens limits the fallout if a credential is compromised. Staying vigilant for similar typosquatting or dependency confusion attempts will keep the supply chain harder to abuse.